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Dear Sirs 


PIMFA’s: response to ICO Call for Views on updating the Data Sharing Code of Practice 


As you have already noted in the introduction to the Call for Views, the text of the Code of 
Practice is very out of date and will need to be brought in line with both GDPR and the Data 
Protection Act 2018. 


Here are some general comments/suggestions that you may want to take into account when 

updating the text of the Code of Practice: 

e The current text is lengthy and repetitive at times, and lacks references to relevant 
provisions/guidance. This results in the Code of Practice looking disconnected to the rest 
of the data protection “ecosystem” and may result in poor uptake from businesses. To 
avoid this and ensure that the Code of Practice becomes an integral part of a business’s 
data protection setup, we suggest you add hyperlinks to ICOAWP29 guidance as well as to 
laws and regulations where relevant. This would link the Code of Practice to other relevant 
rules and guidance as well as removing the need for repetition. 

e One example that you may want to consider putting in the Code of Practice, in the “Ad hoc 
or ‘one-off sharing” section, is one-off data sharing to the US for a pension transfer where 
Privacy Shield is not applicable — how can this be done without a data sharing agreement, 
which for a one-off transfer can be considered disproportionately costly? 


If you have any queries or would like to discuss any of the above further please do not hesitate 
to contact us. 
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